CVE-2025-23201: Reflected Cross-site Scripting on error alert in librenms
Description
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Classification
CVE ID: CVE-2025-23201
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.4
Affected Products
Vendor: librenms
Product: librenms
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.64% (scored less or equal to compared to others)
EPSS Date: 2025-02-14 (when was this score calculated)